Privacy Policy

This policy applies to wabapi.com and the WABAPI application. It covers two different sets of people, and the distinction matters throughout.

• You, our customer. The business that creates an account, buys credits and sends campaigns.
• Your recipients. The people you send WhatsApp messages to. We process their data on your instructions, not for our own purposes.

For your recipients' data you are the controller and we are the processor. You are responsible for having a lawful basis to message them.

• Account details. Your WhatsApp phone number, business name, the one-time codes used to confirm your number or reset your password, and your password — stored only as a salted one-way hash (scrypt), never in plain text, so no one at WABAPI can read it.
• WhatsApp Business account details. The business number you connect, its display name, quality rating and messaging limits, as reported by Meta.
• Billing records. Payment identifiers, amounts in rupees, credit purchases and your credit ledger. Card and bank details are handled by Razorpay and never reach our servers.
• Usage and diagnostics. Server logs, timestamps, IP address and error traces, kept to operate and secure the service.

When you upload a contact list or run a campaign, we process the recipient data you provide:

• Recipient phone numbers and any names or variables in your list
• The template content you choose to send
• Delivery events — sent, delivered, read, replied, failed — with timestamps and failure reasons
• Replies your recipients send back to your number

We do not sell this data, do not use it to build profiles, and do not use it to market to your recipients. It exists so you can run and audit your campaigns.

• To create and secure your account, to confirm your number by one-time code, and to sign you in
• To deliver the messages you ask us to send, and to report on them
• To take payment, allocate credits and maintain an accurate ledger
• To detect and prevent abuse, fraud and misuse of the platform
• To meet legal and accounting obligations in India
• To measure whether our own advertising works — see “Cookies and advertising measurement” below

We share data only with the parties needed to run the service:

• Meta Platforms — WhatsApp message delivery. Your messages and recipient numbers necessarily pass through WhatsApp, and Meta's own terms and privacy policy apply to that processing.
• Our messaging infrastructure provider — the platform through which our connection to the WhatsApp Business API is operated.
• Razorpay — payment processing. They receive the payment details you enter directly with them; we receive only the result.
• Hosting and infrastructure providers — servers and databases operating the service.
• Google and Meta, for advertising measurement — limited to what is described under “Cookies and advertising measurement” below. This is about you as our customer or visitor; it never includes your messages or your contacts.

We do not sell personal data to anyone, and we do not share it for anyone else's advertising.

The service is operated for Indian businesses sending to Indian (+91) numbers. Account, campaign and ledger data is retained while your account is open.

• Campaign and delivery records are kept so you can audit past sends, and are removed when you delete your account.
• Billing and credit-ledger records are retained for as long as Indian accounting and tax law requires, even after account closure.
• One-time sign-in codes expire within minutes and are not retained afterwards.

You can ask us to access, correct, export or delete your account data. Write to support@wabapi.com from the email or phone number on the account and we will respond within a reasonable period.

If one of your recipients asks you to delete their data, you can remove them from your contact lists in the application. Where we hold that data only as your processor, we will act on your instruction.

Traffic is served over HTTPS with HSTS. You sign in with your number and a password, which we store only as a salted one-way hash (scrypt), never in plain text; a forgotten password is reset with a one-time code sent to your WhatsApp number. Payment credentials never touch our servers. Access to production data is limited to the people who operate the service.

No system is perfectly secure. If a breach affects your data we will tell you and take the steps the law requires.

We use a session cookie to keep you signed in. It is required for the application to work.

We also advertise WABAPI, and we measure whether that advertising works. This is what runs, and where:

• Google Tag Manager loads on every page of wabapi.com, including the signed-in application. It is a container through which we load measurement tags; Google receives the usual technical details a browser sends when it fetches a script, such as your IP address and browser type.
• The Meta pixel loads on our public pages — the home page, pricing, guides, sign-up and sign-in — and records that a page was viewed, that our pricing or cost calculator was opened, and that a sign-up was completed. These browser events carry a page name or an event reference and nothing that identifies you. The pixel may set its own cookies. It does not load on the screens where you work with campaigns, contacts, templates, credits, settings or your API key.
• Sign-up and purchase events are reported to Meta from our server, not from your browser. A report says that an account was created or that credits were bought, with the amount and the pack. So that Meta can match it to an advertisement, it carries your sign-in phone number in hashed form — a one-way scramble, never the number itself — and, if you first reached us by tapping one of our WhatsApp adverts, the click reference Meta attached to that tap. A sign-up report also carries the technical details of the browser you signed up from — its IP address, its browser type, the page address and the identifiers Meta's own cookies hold — which is what Meta asks for to match a website event.

None of this ever includes the content of your messages, your contact lists or anything about your recipients. It concerns you as our customer or visitor, and we use it only to measure and improve our own advertising.

There is no opt-out switch on this site today. You can stop the browser-side measurement by blocking third-party cookies or using a content blocker, and you can limit how Meta and Google use activity from other websites in your own Meta and Google account settings. The reports sent from our server are not affected by browser settings; if you have a question or an objection about them, write to support@wabapi.com.

If this policy changes materially we will update the effective date above and, where the change affects you, tell you in the application.

Questions about this policy, or about data we hold, go to support@wabapi.com. See also our Terms of Service and Cancellation & Refund Policy.